Information such as failure diagnosis information or learned control values needs to be stored in an electronic control system for an automobile even while no operating electric power is supplied to the electronic control system. The information is therefore conventionally stored in a non-volatile memory such as EEPROM where data is electrically erasable. The information can be thereby continuously stored even when a backup battery runs out or is being disconnected. For instance, data in a given area of backup RAM being backed up by a battery is seriatim stored in EEPROM. When the data in the backup RAM is determined to be abnormal at starting timing of an operation period just after tuning on of operating electric power, the corresponding data in the EEPROM is written in the given area in the backup RAM. (Refer to Patent 1: JP-A-H4-336351.)
In this kind of the electronic control system, normality of the data stored in EEPROM is checked by using checksum. (Refer to Patent 2: JP-A-H5-216776.) Furthermore, there are other checking methods as follows: (1) Mirror data method and (2) Majority vote method. In Mirror data method, target data is stored in EEPROM along with mirror data. Here, the sum of an original value of the target data and the mirror data is designed as being a given value. When the sum of the target data and the mirror data does not become the given value, abnormality is determined. In Majority vote method, the target data is redundantly stored in three areas in EEPROM. The correct original value is determined by a majority vote among the three.
Meanwhile, an electronic control system for an automobile needs to continuously store a monitor frequency ratio according to Rate Base Monitor Method of OBD II (On Board Diagnostic II) by CARB (California Air Resources Board). The monitor frequency ratio is defined with the following formula:Monitor frequency ratio=monitoring execution frequency/operation frequency
Here, the monitor frequency ratio is a frequency ratio of a failure diagnosis being executed on a given item and exists for each item such as a catalyst converter, a fuel evaporation system, an O2 sensor, and the like. The operation frequency (hereinafter, referred to as denominator) is data that is incremented when a given traveling condition specified by legislation is effected for the given item. The monitoring execution frequency (hereinafter, referred to as numerator) is data that is incremented when it is determined that normality or anomaly is present after a condition of failure diagnosis execution specified by an automotive manufacturer is effected for the given item. Each of the numerator and the denominator is incremented by one or remains without being incremented, for an operation period. The operation period is from turning on to turning off of an ignition switch of the vehicle, or from turning on to turning off of operating electric power to an electronic control system executing a failure diagnosis. Therefore, once a numerator or denominator for the given item is incremented for a given operation period, the numerator or denominator is no more updated for the given operation period.
In the above checking methods, whether data in EEPROM is broken or not can be checked. However, whether rewriting data in the non-volatile memory such as EEPROM is completed or not for the preceding operation period of the electronic control system cannot be checked. In other words, failure to properly store data, or missing of storing data (hereinafter, also referred to as mis-storing of data) in EEPROM for the preceding operation period cannot be checked.
Namely, even when the mis-storing of data takes place, checksum or mirror data remains normal in relationship with the data that was unable to be rewritten. In Majority vote method, the same data is stored in three areas of the memory. The data is checked for each bit order in the three areas, so that the same bit appearing in more than one area is recognized as a correct bit in each bit order. Here, the mis-storing of data cannot be checked, either.
In particular, reading/writing data in EEPROM is executed through a serial communications line with a micro-computer, so that processing time for the reading/writing data needs to be more than that in RAM being built in the micro-computer. Therefore, there is a probability that the operating electric power to the electronic control system is turned off before the rewriting data in EEPROM is completed.